Cb Response: Configurations to mitigate out of disk issues in 5.x
search cancel

Cb Response: Configurations to mitigate out of disk issues in 5.x

book

Article ID: 289920

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Change settings in the Cb Response server environment to prevent future disk space issues.

Environment

  • Cb Response Server: 5.x

Resolution

 

  1. Verify that OER disk requirements are being followed - https://community.carbonblack.com/t5/Documentation-Downloads/Carbon-Black-Response-v5-2-Operating-Environment-Requirements/ta-p/36551
  2. Verify MaxEventStoreDays, MaxEventStoreSizeInPercent, MaxEventStoreSizeInDocs (5.x) are set to reasonable values in /etc/cb/cb.conf - Selecting an Event From the Alerts Page Results in a 404 Page
    • Note: changing these settings will require a service restart
  3. Adjust Modulestore retention settings: Modulestore Filling Disk When Alliance Sharing Is Disabled

  4. Verify EventPurgeEarliestTime does not have a date in the past: 5.x no disk space available on Cb Response server due to cbevent purge settings in past
  5. Enable automated purging of Cbmodules -  How To Enable Automated Cbmodule Purging
  6. Set up a job to automatically clear old Datastore logs - https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-add-a-datastore-tmp-removal-cron-job/ta-p/62901